Everything Shell Bulletin has reported about api security: 3 stories, newest first. Part of our Vulnerabilities coverage.
Broken object level authorization often hides in plain sight because the server returns success codes for unauthorized data access, masking the logic error as valid behavior.
FortiGuard confirms a hard-coded key flaw in FortiSandbox allows unauthenticated access to certain API endpoints via crafted HTTP requests.
Workload identity replaces static credentials with short-lived tokens, preventing attackers from hijacking services even if they breach your network perimeter.